So this is a hack in the browser to fix a security problem in the server. And it requires the same server to send an additional header.
I wonder if they ever evaluate the effectiveness of their work over there at Mozilla.
I wonder if they ever evaluate the effectiveness of their work over there at Mozilla.
It's a bad situation, but it's based on bad decisions that were made in the 90s when the web was in its early days ("be liberal what you accept"). Hard to fix in a general way without breaking lots of stuff.
> While MIME sniffing increases the web experience for the majority of users, it also opens up an attack vector known as MIME confusion attack.
The header tells the browser to stop shenanigans and behave.
On the other hand, doing an inventory and then auditing every place where user-controlled content is replayed and then making and testing the requisite code changes is usually very difficult, and sometimes untenable.